It also has limited benefit against brute force attacks since it's essentially just a few extra numbers added to the password (although that certainly helps).
It does provide a defense against leaked previously passwords, and keyloggers if they aren't immediately used.
I'd love to be corrected if this isn't the case though.
EDIT: Totally forgot - it also protects you if your password manager is breached, assuming you don't store it in the password manager
This assumes a sophisticated attack, which is absolutely possible (I’ve even seen it happen), but is less likely than a form that just captures information. In any case, in the attack you describe, storing the TOTP externally doesn’t provide any additional protection over storing it within the password manager.
> EDIT: Totally forgot - it also protects you if your password manager is breached, assuming you don't store it in the password manager
Yeah that’s the entire point of the article. But managing TOTP separately can be a bit painful. So I’m saying that if you want a bit of additional security without any inconvenience, there are still benefits to storing a TOTP in your password manager opposed to having no MFA at all.
I wanted to make sure the limitations were pointed out that TOTP doesn't itself protect against sophisticated MITM/phishing attacks which a lot of people I've met thought.
But it absolutely provides some level of protection against unsophisticated attacks, and it's still helpful even inside your password manager.
It helps against brute force attacks but how much it helps depends on the service. If your service prompts for a 2FA code when provided with an incorrect password, then it helps a lot. If an attacker receives confirmation that they have a correct password before needing to enter the 2FA code, then it helps less.
And my Bitwarden Vault is hosted on a server I own. If it gets breached, I'm in deep trouble regardless.
However it is a second defense enforced by process/code alone (which can be turned off if you have access to the source). It doesn't effect the way your password is stored on the server, in the event of a leak or hack TOTP provides no brute force benefit.
If I'm using a long random password generated by a password manager, are these attacks realistic?
> phishing / MITM attacks
But if they can phish or otherwise capture my password, can't they just as easily phish or capture my one-time code?
> (or I’m forced to use 2FA when I don’t want to)
IMO, this is the only actual use-case, and it sucks because it adds additional login friction for absolutely no reason. If you want to ensure I'm using a strong password, generate the password for me as a condition to disabling 2FA.
Most likely no. But some people refuse to use such passwords, even when using password managers. Also it was only a few years ago Sony was caught storing passwords in plaintext so… Unless you trust the service is hashing and salting your password, MFA can be a good idea.
> But if they can phish or otherwise capture my password, can't they just as easily phish or capture my one-time code?
The TOTP lasts ~30 seconds. So the attack needs to occur in real-time (opposed to a form that just captures information). Can this happen? Absolutely. But it still raises the bar for the attack.
But yeah I agree, forced 2FA is infuriating.
Though that site is likely also storing the TOTP shared secret in plaintext, beside the password, making it pretty much pointless. If the site itself is compromised, it's hard to come back from that.
Pretty much the best thing you can do is never re-use passwords across sites.
For super important stuff, such as email accounts, I use an external authenticator. For medium important stuff where I want a bit of extra security (or I’m forced to use 2FA when I don’t want to), I store it in the password manager.